What is the CVSS score of CVE-2026-57299?

CVE-2026-57299 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Contrast Security Plugin CVE-2026-57299

EUVD-2026-38780 MEDIUM

Missing Authorization (CWE-862)

2026-06-24 jenkins

GHSA-8263-qv4g-vfxr

Authentication Bypass Jenkins Jenkins Contrast Continuous Application Security Plugin Jenkins Project

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Enumeration of metadata names is a confidentiality impact (C:L), not integrity; all other metrics align with the provided CVSS vector.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 04:30 vuln.today

CVSS changed

Jun 26, 2026 - 02:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 24, 2026 - 13:20 cve.org

UNKNOWN (no severity yet)

DescriptionNVD

Missing permission checks in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allow attackers with Overall/Read permission to enumerate the names of configured Contrast metadata.

AnalysisAI

Missing authorization checks in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allow any authenticated Jenkins user with the low-privilege Overall/Read permission to enumerate the names of configured Contrast metadata via a network-accessible endpoint. The vulnerability is classified CWE-862 (Missing Authorization) and has an EPSS score of 0.15% (4th percentile), indicating negligible real-world exploitation activity. No public exploit code and no CISA KEV listing have been identified, making this a low-urgency but real information-disclosure concern for multi-tenant Jenkins environments with untrusted users.

Technical ContextAI

Jenkins enforces authorization through a permission-based model; Overall/Read is one of the most broadly granted permissions, typically held by all registered Jenkins users. The Contrast Continuous Application Security Plugin integrates Contrast Security's SAST/DAST tooling into Jenkins pipelines and stores named metadata configurations. CWE-862 (Missing Authorization) indicates the plugin's HTTP endpoint for Contrast metadata retrieval performs no secondary privilege check beyond basic authentication, allowing the metadata configuration namespace to be enumerated by any authenticated caller. The affected product is fully identified via CPE cpe:2.3:a:jenkins_project:jenkins_contrast_continuous_application_security_plugin:*:*:*:*:*:*:*:* covering all releases from 0 through 3.11 inclusive.

RemediationAI

Upgrade the Jenkins Contrast Continuous Application Security Plugin to a version released after 3.11 by consulting the Jenkins Plugin Manager or the vendor advisory at https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3697%20(2); the exact fixed version is not independently confirmed from available data, so administrators should verify the latest release in the Jenkins update center. As a compensating control prior to patching, tighten the Jenkins authorization strategy to restrict Overall/Read access to only trusted, vetted users - this removes the attacker's foothold by eliminating the prerequisite permission. Note that reducing Overall/Read access may break other Jenkins functionality for affected users and should be validated in a staging environment before applying in production. Blocking internal network access to the specific plugin endpoint is also viable if the endpoint path is identifiable from the advisory.